Quick script to scrape ssh pubkeys from a server via ssh-keyscan and sign them with an SSH CA

ssh-keygen-sign.sh

#!/bin/sh

umask 77
TMPDIR=$(mktemp -d)
HOST="${1}"

cd ${TMPDIR}

for TYPE in dsa ecdsa ed25519 rsa; do
        # ssh-key{gen,scan} are very smart and their outputs are not directly compatible, very cool
        ssh-keyscan -t ${TYPE} ${HOST} | cut -d' ' -f 2- > ssh_host_${TYPE}_key.pub
        if [ ! -s ssh_host_${TYPE}_key.pub ]; then
                rm ssh_host_${TYPE}_key.pub;
        fi
done

sudo ssh-keygen -s /etc/ssh/ca -h -I "${HOST}" -n "${HOST}" ./*

echo "signed keys for host ${HOST} in ${TMPDIR}"